OT/IoT Security: What It Is and How to Shield Your Infrastructure

⏱️ Reading time: 13 min

During the night of October 11 to 12, 2026, an OT/IoT security failure caused refrigerators at several European supermarket chains to start defrosting on their own, with the automatic cycle forced to run nonstop and the temperature set to 50 degrees.

📑 En este artículo

1. TL;DR
2. What Is OT/IoT Security?
3. Why It Matters: From the Supermarket to the Hospital
4. How an Attack on OT/IoT Systems Works
5. Real-World Cases: From the Cold Chain to a Store’s HVAC
6. OT/IoT Security Best Practices
7. Common Mistakes When Securing Connected Devices
8. Going Deeper: Protocols, the Purdue Model, and Zero Trust in OT
9. Frequently Asked Questions
   1. What sets industrial cybersecurity apart from traditional IT security?
   2. Why are industrial IoT devices more vulnerable than a laptop?
   3. How do you segment an OT network in a small store or factory?
   4. What should you do if an OT device doesn’t support firmware updates?
   5. Do office IoT cameras and sensors count as OT attack surface?
10. References

Intermarché, Leclerc, and Coopérative U confirmed the attack on their refrigeration facilities; Coopérative U’s president, Dominique Schelcher, called it “extremely serious.” The attack is attributed to Danfoss controllers connected without the isolation that industrial cybersecurity requires.

TL;DR

• Segmenting the OT network from corporate IT prevents a compromised router from reaching a refrigeration controller.
• Changing the default credentials on a PLC or Modbus gateway closes the most common entry point used in OT attacks.
• Updating an industrial controller’s firmware closes known vulnerabilities before an attack happens.
• Detecting anomalies in OT network traffic flags when a device starts behaving differently.
• VLANs, industrial firewalls, and certificate-based authentication form the three minimum layers of OT/IoT defense.

What Is OT/IoT Security?

OT/IoT security is the set of practices that protects connected devices controlling physical processes (sensors, PLC controllers, cameras, industrial refrigerators) from unauthorized access. Unlike traditional IT security, it prioritizes the availability of the physical process over data confidentiality.

OT stands for operational technology: the software and hardware that run a factory, a power plant, or a supermarket’s cold storage. IoT, the internet of things, is the layer of sensors and actuators that connects that machinery to an IP network. When the two mix without control, a simple temperature sensor can end up becoming the entry point into an entire production system.

In practice, OT/IoT security covers systems as different from one another as a SCADA system monitoring a power grid, an HMI (human-machine interface) on a factory floor, or a simple Bluetooth temperature sensor on a supermarket shelf. They all share the same underlying risk: they were designed to work, not to withstand an attack.

The difference from an office server is physical. If ransomware encrypts a laptop, a file is lost. If an attacker takes over a refrigeration compressor’s controller, what’s lost is the temperature chain for thousands of kilos of food, with all the logistical and health costs that implies.

Why It Matters: From the Supermarket to the Hospital

The attack on Intermarché, Leclerc, and Coopérative U during the night of October 11 to 12, 2026 forced refrigerators into continuous defrosting at 50 degrees, according to a report from Tom’s Hardware. Coopérative U’s president, Dominique Schelcher, described the incident as “extremely serious” and confirmed that several stores in his chain had their refrigeration production affected.

The same pattern repeats across other sectors. A hospital depends on connected infusion pumps and monitors; a power plant depends on relays and voltage sensors; a factory depends on robotic arms and conveyor belts. None of these devices were designed with the expectation of being exposed to the internet, but today almost all of them are, even if only indirectly through a maintenance VPN or a remote management router.

The most well-documented case of a purely OT attack remains Stuxnet, the worm that sabotaged uranium enrichment centrifuges by directly manipulating the Siemens controllers that operated them. More than a decade later, the underlying pattern hasn’t changed: find a poorly isolated OT device and manipulate its control logic to cause physical damage.

The cost of a disruption in the cold chain isn’t measured in money alone. A supermarket that loses control of its refrigerators for hours faces the choice of discarding fresh products or assuming the health risk of selling them anyway. Multiplied across dozens of stores in several countries, as happened in October 2026, the incident stops being an IT problem and becomes a supply chain problem.

Governments and regulators already treat OT/IoT security as a critical infrastructure issue, not just an IT one. CISA, the US cybersecurity agency, publishes specific alerts for industrial control systems, and frameworks like the NIST SP 800-82 family exist because a web server and a refrigeration controller can’t be protected by the same rules.

⚠️ Watch out: an industrial controller can go ten or fifteen years without rebooting. That means ten or fifteen years of accumulated security patches that were never applied.

How an Attack on OT/IoT Systems Works

Most incidents don’t enter directly through the OT network: they enter through the corporate IT network, which usually has more weak points (email, VPN, employee laptops), and then pivot toward the plant. The jump happens when both networks share switches, credentials, or a misconfigured firewall that allows traffic in both directions.

Before attacking, there’s almost always a reconnaissance phase. The attacker looks for which plant devices respond on the internet, which ports are open, and which firmware version they’re running. That information is often available without any intrusion at all, exposed by the protocol itself when the device isn’t behind a firewall.

Another common vector is the engineering workstation: the computer technicians use to program and maintain the PLCs. If that machine also browses the internet or receives email, a simple phishing attack targeting the maintenance technician can end with valid credentials to write control logic directly into the plant.

Once inside the OT network, the attacker finds industrial protocols like Modbus or BACnet that, in their classic versions, require no authentication: any device that speaks the protocol can send a command and the controller executes it without asking who sent it. Public tools like Shodan index thousands of these devices exposed directly to the internet, without even needing to pivot from an internal network.

sequenceDiagram
participant A as Attacker
participant IT as Corporate IT network
participant OT as OT network
participant PLC as Refrigeration controller
A->>IT: compromises an exposed VPN or router
IT->>OT: pivots because there is no segmentation
OT->>PLC: sends an unauthenticated Modbus command
PLC-->>OT: executes the command without validating it
Note over OT,PLC: this is where segmentation stops the attack

The final outcome depends on what the compromised device controls. In the case of the European supermarkets, the command forced a continuous defrost cycle instead of the usual two hours a day. At a chemical plant, the same type of access could open a valve; at a hospital, it could shut off a monitor. The attack logic is identical, only the actuator on the other end changes.

Real-World Cases: From the Cold Chain to a Store’s HVAC

The October 2026 episode isn’t the first time a climate control or refrigeration system has ended up being the weak link. In 2013, a US retail chain suffered a breach that started with the credentials of a third-party HVAC vendor with remote access to the store’s network, a reminder that the risk doesn’t always originate in the device itself: sometimes it originates with the vendor maintaining it.

Smart climate control (HVAC) systems in commercial buildings are another common target, because they’re often managed remotely by a third-party vendor with direct access to the building’s network. A misconfigured BACnet controller on a shopping mall’s rooftop can end up being the entry point to security cameras, elevators, or the in-store payment system, all connected to the same unsegmented network.

In retail, the inventory of connected devices grows without anyone fully noticing: barcode scanners, electronic shelf labels, security cameras, temperature sensors, smart scales. Each one is a potential entry point if nobody documented or isolated it.

OT/IoT Security Best Practices

There’s no single control that solves the problem. Real defense combines several layers, and each one covers what the previous one lets through.

flowchart TD
A["Internet"] --> B["Corporate IT network"]
B --> C["Industrial firewall"]
C --> D["Segmented OT network"]
D --> E["Refrigeration PLC"]
D --> F["IoT sensors"]
subgraph Plant
D
E
F
end

Segmentation delivers the most impact for the effort it requires: a well-configured industrial firewall between IT and OT would have forced the European supermarket attacker to compromise a second point, not just the first one.

A small store doesn’t need the same budget as a power plant, but it can apply the same logic on a smaller scale: a dedicated VLAN for refrigeration and point-of-sale devices, unique passwords per device, and a simple firmware review schedule are enough to close most of the vectors seen in the October 2026 attack.

💡 Tip: if you can’t audit every OT device at once, start with the inventory: you can’t protect what isn’t on a list.

Common Mistakes When Securing Connected Devices

The most repeated mistake is leaving the factory-default password in place. Many industrial controllers and gateways ship with a username and password publicly documented by the manufacturer, and rarely does anyone change them because “it works” as is.

The second mistake is treating the network as flat: everything connected to the same switch, with no VLANs or firewall rules between segments. Under that setup, any compromised device, even a cheap security camera, can reach the plant’s most critical controller.

The third mistake is postponing firmware updates because the device “works fine as is.” CISA regularly publishes advisories about vulnerabilities in industrial controllers, and most go unpatched for months because updating requires a maintenance window that nobody wants to schedule.

The fourth mistake, less obvious, is trusting the third-party vendor without auditing their remote access. The 2013 HVAC case showed that a poorly protected maintenance credential is worth just as much to an attacker as a zero-day vulnerability.

The fifth mistake is not having a response plan specific to OT. When the attack on the European supermarkets occurred, Coopérative U’s immediate response was to mobilize teams alongside refrigeration technicians, because shutting down and restarting an industrial controller isn’t as simple as reinstalling an operating system: it requires coordination with whoever knows the physical machinery.

Going Deeper: Protocols, the Purdue Model, and Zero Trust in OT

The reference architecture for separating levels in a plant is known as the Purdue model: it divides the network into layers, from sensors and actuators (level 0) to enterprise management systems (level 5), with an industrial demilitarized zone between OT and IT. In practice, many plants collapse several levels into a single flat network due to cost or a lack of specialized staff, and that collapse is exactly what an attacker exploits.

Modbus, BACnet, and DNP3 are the most common protocols in industrial control systems and building automation. None of them were designed with a remote attacker in mind: they were built in the eighties and nineties for closed networks, with no encryption or authentication, and today they still run the same way over internet-connected IP networks. Adapting them with an external authentication layer, rather than replacing them, is the most realistic solution for most existing plants.

To classify attacker behavior in these environments, the community uses MITRE ATT&CK for ICS, an extension of MITRE’s general framework focused on techniques specific to industrial control systems: from device discovery to direct manipulation of the physical process. Mapping an incident against that matrix helps identify which defense layer failed.

In the most critical environments, such as nuclear power plants or water infrastructure, segmentation is taken to the extreme with data diodes: hardware that only allows traffic in one direction, from OT to an external monitoring system, and physically cannot send anything back. It’s an expensive and inflexible solution, but it completely eliminates the possibility of a remote command reaching the controller.

The concept of zero trust applied to OT doesn’t mean distrusting every packet in real time, something barely viable on low-latency industrial networks. It means every new device authenticates before talking to another, no segment trusts by default the traffic arriving from another segment, and remote maintenance access always goes through an audited gateway, never through a VPN shared among vendors. No single control is enough: OT/IoT security depends on combined layers, not a single patch or firewall.

Your next step: ask your network team for the current diagram of your plant or store and mark in red every point where the OT network and the IT network touch without a firewall in between.

Frequently Asked Questions

What sets industrial cybersecurity apart from traditional IT security?

IT security prioritizes data confidentiality; industrial cybersecurity prioritizes keeping the physical process (a production line, a cold chain) from stopping or being tampered with, even if that means sacrificing immediate patching for operational stability.

Why are industrial IoT devices more vulnerable than a laptop?

Because they’re rarely updated, many use protocols with no native authentication, and they stay powered on for years without rebooting, accumulating known vulnerabilities that on a laptop would get patched at the next monthly restart.

How do you segment an OT network in a small store or factory?

With separate VLANs for OT and IT, an industrial firewall between them that only allows strictly necessary traffic, and an explicit list of which device can talk to which other one.

What should you do if an OT device doesn’t support firmware updates?

Isolate it in its own network segment, restrict as much as possible who can reach it, and, if the manufacturer allows it, place an intermediate gateway that adds the authentication the device lacks.

Do office IoT cameras and sensors count as OT attack surface?

Yes, if they share a network with industrial control systems. An unpatched, low-cost IoT device is, for an attacker, the easiest path to a much more critical controller on the same network.

References

• Tom’s Hardware: coverage of the attack on Intermarché, Leclerc, and Coopérative U’s refrigerators.
• CISA: official cybersecurity guidance and alerts for industrial control systems.
• NIST CSRC: reference publications such as the SP 800-82 family for industrial control systems security.
• Wikipedia: history of the Stuxnet worm, the most well-documented OT attack against an industrial plant.
• Shodan: search engine that indexes industrial devices exposed to the internet.
• MITRE ATT&CK for ICS: matrix of attack techniques specific to industrial control systems.

📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Jordan Harrison en Unsplash